A civic GPO grants local administrator rights on workstations to a broad user group. Why is this a significant AD-related finding?
Select an answer to reveal the explanation.
Short Explanation
Handing local admin to a big user crowd is like leaving spare house keys under every doormat. Once someone has one workstation key, hopping to the next desk gets easy. Call out that GPO sprawl.
Full Explanation
A civic GPO that grants local administrator rights on workstations to a broad user group is significant because broad local administrator grants enable trivial privilege use on many hosts and ease lateral movement class risks. Local admin via GPO is not limited to screensaver timeouts. Broad local admin does not harden workstations by forcing shared desktop profiles. Attackers do not ignore GPO-based local admin merely because it is not a directory group name—the effective local rights still matter. Exam caveat: effective local privilege distribution is as important as domain group membership. Operational check: review restricted groups or local admin GPO settings, quantify how many workstations inherit the grant, recommend least-privilege helpdesk models, and validate that Domain Users (or similarly broad groups) are removed from local Administrators. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.